CVE-2026-117499 @fastify/session vulnerable to session revocation bypass via a logout race condition

@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the session destroy call, recreating the destroyed session...

CVE-2026-117499

The @fastify/session plugin for Fastify is vulnerable to a session revocation bypass via a logout race condition in all releases before 11.1.6 . With default rolling session behavior, a request that restores a session before a logout can save a copy after a concurrent request completes the destro...